net1[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

net1.exe
Size

139KB
MD5

c13dda779e0aa70cc8a87b203d7519a4
SHA1

a09a66e4bb576ea349e7e954f29d7253eef2d42d
SHA256

fe9c3cb1d90a1f489daa71357ac7b1cbac9ef8e415ad441f70cf8cae9894a831
SHA512

88dc28a6ee87fd70e112f9324ba7369118fce86fdc92575099ae4800333830854f11dbbbb03375e2021a9062dab822a22c5fb37ac93d3dfe39ede45fece8f52b
SSDEEP

3072:qI9tu8fdONhc6SzuWiuaAbE9+U48XuUB5VE+vbclTKmHBJEy:qyZONoe48XXDjvbctKmHBiy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
net1.exe

Files

net1.exe
.exe windows:10 windows x86 arch:x86

fa57ec07c0a8e480f5d417e8860b906d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

net1.pdb

Imports

msvcrt

_vsnwprintf_s
putchar
wcstod
_wcsdup
_snwprintf_s
wcspbrk
wcstok
_ftol2
_ftol2_sse
_local_unwind4
memcpy
memmove
_wcsicmp
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
wcscspn
iswctype
wcsrchr
calloc
_wcsrev
malloc
free
realloc
swprintf_s
_ultow
wcsstr
wcsncat_s
_vsnwprintf
wcschr
sprintf_s
_wcsnicmp
_fileno
_setmode
setlocale
exit
wcsspn
qsort
wcsncmp
wcscpy_s
_wcsupr
wcsncpy_s
_cexit
_wcslwr
wcscat_s
__iob_func
memset

samcli

NetGroupGetInfo
NetGroupSetInfo
NetUserDel
NetGroupGetUsers
NetGroupEnum
NetGroupAddUser
NetGroupDel
NetGroupAdd
NetUserSetInfo
NetUserGetGroups
NetUserEnum
NetUserGetInfo
NetUserAdd
NetUserModalsSet
NetUserModalsGet
NetGroupDelUser

netutils

NetApiBufferReallocate
NetApiBufferAllocate
NetpwNameValidate
NetApiBufferFree
NetapipBufferAllocate
NetpwListCanonicalize
NetpwNameCompare
NetpwListTraverse
NetpwPathType
NetpwNameCanonicalize

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

dsrole

DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
SetLocalTime
GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-synch-l1-2-0

Sleep

srvcli

NetFileGetInfo
NetFileClose
NetFileEnum
NetSessionEnum
NetServerTransportEnum
NetServerSetInfo
NetServerGetInfo
NetConnectionEnum
NetSessionGetInfo
NetSessionDel
NetShareGetInfo
NetShareCheck
NetShareEnum
NetShareSetInfo
NetShareDel
NetShareAdd
NetShareDelSticky
NetRemoteTOD

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW

api-ms-win-core-localization-l1-2-0

SetThreadUILanguage
FormatMessageW
GetUserDefaultLCID
GetCPInfo

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
GetCommandLineW

api-ms-win-core-console-l1-1-0

GetConsoleMode
SetConsoleMode
ReadConsoleW
GetConsoleOutputCP
WriteConsoleW

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

HeapSetInformation

wkscli

NetUseDel
NetWkstaUserGetInfo
NetWkstaTransportEnum
NetWkstaGetInfo
NetUseEnum
NetWkstaStatisticsGet

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW

api-ms-win-security-base-l1-1-0

AddAccessAllowedAce
GetSidSubAuthority
SetSecurityDescriptorDacl
GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
GetSidLengthRequired
CopySid
GetSecurityDescriptorDacl
CreateWellKnownSid
EqualSid
GetAce
GetSidSubAuthorityCount

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalFree
GlobalAlloc
LocalAlloc

api-ms-win-core-file-l1-1-0

GetFileType
GetDriveTypeW
WriteFile

api-ms-win-core-sysinfo-l1-2-0

SetSystemTime

logoncli

DsGetDcNameW

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

cryptbase

SystemFunction036

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
StartServiceW
CloseServiceHandle

api-ms-win-service-core-l1-1-2

GetServiceKeyNameW
GetServiceDisplayNameW

api-ms-win-service-core-l1-1-1

EnumServicesStatusExW
EnumDependentServicesW

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-console-l1-2-0

PeekConsoleInputW

api-ms-win-core-privateprofile-l1-1-0

GetProfileStringW

api-ms-win-security-activedirectoryclient-l1-1-0

DsUnBindW
DsBindWithSpnExW
DsCrackNamesW
DsFreeNameResultW

ntdll

NtQuerySystemTime
RtlGetNtProductType
RtlLengthSid
RtlAllocateHeap
RtlCopySid
RtlxOemStringToUnicodeSize
RtlInitString
RtlOemStringToUnicodeString
RtlInitUnicodeString
RtlInitAnsiString
RtlQueryTimeZoneInformation
NtSetInformationThread
NtAdjustPrivilegesToken
NtDuplicateToken
RtlTimeFieldsToTime
RtlSubAuthorityCountSid
RtlInitializeSid
RtlLengthRequiredSid
RtlSubAuthoritySid
RtlTimeToSecondsSince1970
NtClose
RtlNtStatusToDosError
NtOpenProcessToken

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa57ec07c0a8e480f5d417e8860b906d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

samcli

netutils

api-ms-win-core-registry-l1-1-0

dsrole

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-0

srvcli

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

wkscli

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

logoncli

api-ms-win-core-datetime-l1-1-0

cryptbase

api-ms-win-service-management-l1-1-0

api-ms-win-service-core-l1-1-2

api-ms-win-service-core-l1-1-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-security-activedirectoryclient-l1-1-0

ntdll

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 110KB - Virtual size: 110KB

.data Size: 9KB - Virtual size: 51KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 144B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 110KB - Virtual size: 110KB

.data
Size: 9KB - Virtual size: 51KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 144B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB